The Pro CISO Newsletter

The security news our team thinks matters, about once a month · choose your topics · unsubscribe at any time

Cybersecurity Microsoft 365: let an app send mail from chosen mailboxes only Pro CISO · 17 Oct 2026 Granted the usual way in Entra ID, Mail.Send lets an application send as any mailbox in your organisation, the CEO's included. Our step-by-step guide registers the app, puts the al...
Cybersecurity Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack BleepingComputer · 17 Oct 2026 ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 te...
Cybersecurity Drupal patches critical RCE flaws, warns exploits may emerge soon BleepingComputer · 17 Oct 2026 Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. [......
Threat Intel Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups GBHackers · 17 Oct 2026 Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise to shut off application access and interrupt...
Cybersecurity ConnectWise SkyKick Credentials Abused in Microsoft 365 Attacks, Backup Services Shut Down CyberPress · 17 Oct 2026 Attackers abused a compromised credential from ConnectWise Cloud Backup (formerly SkyKick) to access Microsoft 365 customer environments. Jonathan Semon confirmed unauthorized sign...
Cybersecurity Encryption Is Getting Squeezed From All Sides Wired Security · 17 Oct 2026 Canada’s planned surveillance law is the latest grim step in a series of threats to encryption that are spreading around the world.
Cybersecurity MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon The Hacker News · 17 Oct 2026 Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgde...
Cybersecurity Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel SecurityWeek · 17 Oct 2026 Israeli company Discover-Tech’s ads allow threat actors to fingerprint and track devices at scale and infect selected targets. The post Israeli Ad Firm Doubled as Candiru’s Zero-Cl...
Threat Intel Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years GBHackers · 17 Oct 2026 Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds for five NIST elliptic curves in under 30 minutes, addressing a cryp...
Threat Intel Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication GBHackers · 17 Oct 2026 Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to analysis by Seqrite researcher Amruta Wagh. Dubbed WP2Shell, the explo...
Threat Intel OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root GBHackers · 17 Oct 2026 A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a separate out-of-bounds write to obtain root privileges. Calif researcher Andrew...
Threat Intel GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories GBHackers · 17 Oct 2026 GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises malicious JavaScript as a font file and targets developer workstations...
Threat Intel SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data GBHackers · 17 Oct 2026 Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with spear-phishing attacks that deploy ReverseRAT on Wind...
Cybersecurity Anthropic’s Claude AI Solves 25-Year-Old NSA Cryptography Mystery in Under 30 Minutes CyberPress · 17 Oct 2026 Anthropic says an internal Claude research model identified how the NSA generated seeds for five prominent NIST elliptic curves in under 30 minutes, resolving a cryptographic prove...
Threat Intel New GhostBat Android Malware Targets 60 Banking and UPI Apps to Steal PINs GBHackers · 17 Oct 2026 A new GhostBat RAT variant targets 60 Android financial application packages used in India, combining accessibility-based PIN capture with a transparent overlay that intercepts int...